CVE-2022-22273

Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access SRA products and older firmware versions of Secure Mobile Access SMA 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier...

CVE-2022-24384: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010...

PT-2022-13510

Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.3 Description The issue is related to the improper neutralization of special elements used in a template engine. This problem affects the GitHub repository microweber/microweber. Recommendations For...

CVE-2022-0896: Improper Neutralization of Special Elements Used in a Template Engine

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3...

CVE-2021-37208: Improper Neutralization of Input During Web Page Generation

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200F, RUGGEDCOM M2200NC, RUGGEDCOM M969...

CVE-2022-26101: Improper Neutralization of Input During Web Page Generation

Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2022-22301

An improper neutralization of special elements used in an OS Command vulnerability CWE-78 in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments...

CVE-2021-41000: Improper Neutralization of Special Elements used in a Command

Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Series, Aruba 8325 Switch Series, Aruba 8400 Switch Series, Aruba CX 8360 Switch...

CVE-2022-25064: Improper Neutralization of Special Elements used in an OS Command

TP-LINK TL-WR840NESV6.20180709 was discovered to contain a remote code execution RCE vulnerability via the function oalwan6setIpAddr...

python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions

A flaw was found in python-pillow. The vulnerability occurs due to Improper Neutralization, leading to command injection. This flaw allows an attacker to externally-influenced input commands that modify the intended command...

CVE-2022-23810

The CVE-2022-23810 issue affects a-blog cms (Appleple) with template injection (Improper Neutralization of Special Elements Used in a Template Engine). A remote authenticated attacker can obtain arbitrary files on the server via unspecified vectors. Affected versions include: 2.8.x before 2.8.75,...

python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions

A flaw was found in python-pillow. The vulnerability occurs due to Improper Neutralization, leading to command injection. This flaw allows an attacker to externally-influenced input commands that modify the intended command...

CVE-2022-24709: Improper Neutralization of Input During Web Page Generation

@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for javascript injection. Use...

CVE-2022-25809

CVE-2022-25809 affects Amazon Echo Dot devices (3rd and 4th Gen). Root cause: improper neutralization of audio output enables arbitrary voice command execution via a malicious skill (remote) or by pairing a malicious Bluetooth device (physical proximity) in an Alexa-versus-Alexa (AvA) scenario. I...

CVE-2021-41599: Improper Neutralization of Special Elements used in a Command

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This...

CVE-2020-13669: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

CVE-2021-44912: Improper Neutralization of Input During Web Page Generation

In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is...

CVE-2021-41018

CVE-2021-41018 affects Fortinet FortiWeb OS command injection via improper neutralization of special elements in HTTP requests. Affected are FortiWeb versions 6.4.1 and below, and 6.3.15 and below. The vulnerability can allow an attacker to execute unauthorized code or commands through crafted HT...

CVE-2021-42638: Improper Neutralization of Special Elements used in a Command

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution...

Cross-site Scripting (XSS)

productsatcontenttypes is vulnerable to cross-site scripting attacks. The vulnerability exists due to Improper Neutralization in the imageviewfullscreen.pt file allowing an attacker to cache poisoning and redirect URLs to untrusted sites...